[7866] in Kerberos
kcmd not encrypted?
daemon@ATHENA.MIT.EDU (michael shiplett)
Tue Aug 27 14:07:34 1996
To: kerberos@MIT.EDU
Date: 27 Aug 1996 13:06:48 -0400
From: michael shiplett <walrus@ans.net>
Reply-To: michael shiplett <walrus@ans.net>
Greetings,
After re-compiling MIT's k5b6 under Solaris 2.5.1 using gcc without
optimization, the r-cmds work. I noticed, however, that while kcmd()
checksums the remote user and the command, it sends them unencrypted
to the remote host. Even though an attacker would be hard pressed to
hijack the connection, this is an unexpected information leak.
Will kcmd() encrypt all of its information in beta 7?
michael
